Some types of malware, when installed on a computer, are configured to contact a controller in order to receive instructions. A particular domain name may be registered and used as a rendezvous point at which the instructions may be obtained by the malware. A single unchanging domain name, however, can generally be identified by authorities and, as such access to that domain name can then be blocked. This would normally thwart the malware.
Over the last several years, however, malware authors have leveraged Domain Generation Algorithms (DGAs) to avoid the use of unchanging domain names. Some malware uses these algorithms to generate thousands of domains per day, one or more of which can be leveraged by the malware authors for command and control purposes. The malware author knows the DGA, and therefore knows one of the domain names that will be generated. He may then register this domain name. The infected computer will then execute the DGA, and try to contact at least some of the generated domain names. Most of these attempts will fail, given that most of the generated domain names are not registered and not active. When and if the subverted computer tries to access the domain name registered by the malware author, however, this access can succeed. Using this domain name, the infected computer can make contact and receive instructions, thereby allowing the malware to proceed. The threat posed by this arrangement is exacerbated by the fact that many computers can be infected in this way and then enabled to operate collectively in a concerted manner as a so-called “botnet.”
A DGA can generate hundreds or thousands of domain names per day. Unless the DGA is known or poorly designed, it is difficult for security products or authorities to determine which domains to block. To further complicate protection efforts, a domain chosen by the malware author may only be active for a single day; after that, the malware can generate another block of domain names the following day. In this situation, countermeasures can only be effective for a day, if at all.